Remove gcp creds from state (#1814)

fixes #1759

Reverts #1715 and
#1691.

The TF providers was already picking up credentials from the env var
before #1691. We have no reason
to store these in the state.

Note that this might break users who depend on the the stored
credentials for authentication. I think this is intended and they can
set up an env var or explicitly configure the provider to store the
credentials.

provider/cmd/pulumi-resource-gcp/schema.json

@@ -174,13 +174,7 @@
                 "type": "string"
             },
             "accessToken": {
-                "type": "string",
-                "defaultInfo": {
-                    "environment": [
-                        "GOOGLE_OAUTH_ACCESS_TOKEN"
-                    ]
-                },
-                "secret": true
+                "type": "string"
             },
             "activeDirectoryCustomEndpoint": {
                 "type": "string"
@@ -330,14 +324,7 @@
                 "type": "string"
             },
             "credentials": {
-                "type": "string",
-                "defaultInfo": {
-                    "environment": [
-                        "GOOGLE_CREDENTIALS",
-                        "GOOGLE_CLOUD_KEYFILE_JSON",
-                        "GCLOUD_KEYFILE_JSON"
-                    ]
-                }
+                "type": "string"
             },
             "dataCatalogCustomEndpoint": {
                 "type": "string"
@@ -100697,8 +100684,7 @@
                 "type": "string"
             },
             "accessToken": {
-                "type": "string",
-                "secret": true
+                "type": "string"
             },
             "activeDirectoryCustomEndpoint": {
                 "type": "string"
@@ -101201,13 +101187,7 @@
                 "type": "string"
             },
             "accessToken": {
-                "type": "string",
-                "defaultInfo": {
-                    "environment": [
-                        "GOOGLE_OAUTH_ACCESS_TOKEN"
-                    ]
-                },
-                "secret": true
+                "type": "string"
             },
             "activeDirectoryCustomEndpoint": {
                 "type": "string"
@@ -101357,14 +101337,7 @@
                 "type": "string"
             },
             "credentials": {
-                "type": "string",
-                "defaultInfo": {
-                    "environment": [
-                        "GOOGLE_CREDENTIALS",
-                        "GOOGLE_CLOUD_KEYFILE_JSON",
-                        "GCLOUD_KEYFILE_JSON"
-                    ]
-                }
+                "type": "string"
             },
             "dataCatalogCustomEndpoint": {
                 "type": "string"

provider/provider_yaml_test.go

@@ -20,6 +20,7 @@ package gcp
 import (
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -564,3 +565,33 @@ func TestRegress1488(t *testing.T) {
 	}
 	]`, proj, proj))
 }
+
+func TestEnvTokenNotInState(t *testing.T) {
+	if testing.Short() {
+		t.Skipf("Skipping in testing.Short() mode, assuming this is a CI run without GCP creds")
+	}
+
+	output, err := exec.Command("gcloud", "auth", "print-access-token").Output()
+	outputStr := strings.TrimSpace(string(output))
+	if err != nil {
+		errMsg := err.(*exec.ExitError).Stderr
+		t.Fatal(string(errMsg))
+	}
+	t.Setenv("GOOGLE_OAUTH_ACCESS_TOKEN", outputStr)
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+	test := pulumitest.NewPulumiTest(t, filepath.Join("test-programs", "storage-bucket"),
+		opttest.LocalProviderPath(providerName, filepath.Join(cwd, "..", "bin")),
+	)
+	googleProj := os.Getenv("GOOGLE_PROJECT")
+	if googleProj == "" {
+		googleProj = testProject
+	}
+	test.SetConfig("gcp:config:project", googleProj)
+
+	test.Up()
+	stack := test.ExportStack()
+	data, err := stack.Deployment.MarshalJSON()
+	require.NoError(t, err)
+	require.NotContains(t, string(data), "accessToken")
+}

provider/resources.go

@@ -496,21 +496,6 @@ func Provider() tfbridge.ProviderInfo {
 					},
 				},
 			},
-			"access_token": {
-				Default: &tfbridge.DefaultInfo{
-					EnvVars: []string{"GOOGLE_OAUTH_ACCESS_TOKEN"},
-				},
-				Secret: tfbridge.True(),
-			},
-			"credentials": {
-				Default: &tfbridge.DefaultInfo{
-					EnvVars: []string{
-						"GOOGLE_CREDENTIALS",
-						"GOOGLE_CLOUD_KEYFILE_JSON",
-						"GCLOUD_KEYFILE_JSON",
-					},
-				},
-			},
 		},
 		ExtraConfig: map[string]*tfbridge.ConfigInfo{
 			"skipRegionValidation": {